nerdexam
(ISC)2

CGRC · Question #379

Where can you find guidance for registering information systems in the organization system inventory? Response:

The correct answer is A. NIST SP 800-37, Revision 1 Guide for Applying the Risk Management Framework to Federal. Guidance for establishing and maintaining an organization's information system inventory is provided within NIST SP 800-37, which describes the Risk Management Framework.

Scope of the System

Question

Where can you find guidance for registering information systems in the organization system inventory? Response:

Options

  • ANIST SP 800-37, Revision 1 Guide for Applying the Risk Management Framework to Federal
  • BNIST SP 800-30, Revision 1 Guide for Applying the Risk Management Framework to Federal
  • CNIST SP 800-38b , Revision 2 Guide for Applying the Risk Management Framework to Federal
  • DNIST SP 800-38d , Revision 1 Guide for Applying the Risk Management Framework to Federal

How the community answered

(26 responses)
  • A
    92% (24)
  • C
    4% (1)
  • D
    4% (1)

Why each option

Guidance for establishing and maintaining an organization's information system inventory is provided within NIST SP 800-37, which describes the Risk Management Framework.

ANIST SP 800-37, Revision 1 Guide for Applying the Risk Management Framework to FederalCorrect

NIST SP 800-37, "Guide for Applying the Risk Management Framework to Federal Information Systems," includes tasks related to organizational preparation, such as establishing and maintaining an up-to-date inventory of information systems and assets, as part of the initial steps for applying the RMF.

BNIST SP 800-30, Revision 1 Guide for Applying the Risk Management Framework to Federal

NIST SP 800-30, "Guide for Conducting Risk Assessments," focuses on the process of performing risk assessments, not on the creation or management of a system inventory.

CNIST SP 800-38b , Revision 2 Guide for Applying the Risk Management Framework to Federal

NIST SP 800-38b, which deals with CMAC (Cipher-based Message Authentication Code), is unrelated to system inventory registration.

DNIST SP 800-38d , Revision 1 Guide for Applying the Risk Management Framework to Federal

NIST SP 800-38d, which deals with AES Galois/Counter Mode (GCM), is unrelated to system inventory registration.

Concept tested: NIST RMF System Inventory

Source: https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final

Topics

#NIST SP 800-37#Risk Management Framework (RMF)#System Inventory#System Registration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice